VMware released eight security updates that fixed vulnerabilities in its products. Some of these could have been exploited for remote code execution.
Tracked from CVE-2022-22954 to CVE-2022-22961 (CVSS scores: 5. 3 – 9. 8), the issues impact VMware Workspace ONE Access, VMware Identity Manager, VMware vRealize Automation, VMware Cloud Foundation, and vRealize Suite Lifecycle Manager.
Five out of eight bugs have been rated as Critical. Two are classified as Important and one has been rated moderately severe. Credited with reporting all the vulnerabilities is Steven Seeley of Qihoo 360 Vulnerability Research Institute.
The list of flaws can be found below –
- CVE-2022-22954 (CVSS score: 9. 8) – Server-side template injection remote code execution vulnerability affecting VMware Workspace ONE Access and Identity Manager
- CVE-2022-22955 & CVE-2022-22956 (CVSS scores: 9. 8) – OAuth2 ACS authentication bypass vulnerabilities in VMware Workspace ONE Access
- CVE-2022-22957 & CVE-2022-22958 (CVSS scores: 9. 1) – JDBC injection remote code execution vulnerabilities in VMware Workspace ONE Access, Identity Manager, and vRealize Automation
- CVE-2022-22959 (CVSS score: 8. 8) – Cross-site request forgery (CSRF) vulnerability in VMware Workspace ONE Access, Identity Manager, and vRealize Automation
- CVE-2022-22960 (CVSS score: 7. 8) – Local privilege escalation vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation, and
- CVE-2022-22961 (CVSS score: 5. 3) – Information disclosure vulnerability impacting VMware Workspace ONE Access, Identity Manager and vRealize Automation
A malicious actor could exploit the weaknesses to gain root privileges, access the hostnames and remote execute arbitrary codes, effectively giving them full control.
“This critical vulnerability should be patched or mitigated immediately,” VMware said in an alert. This vulnerability has serious consequences. “
While the virtualization services provider noted that it has not seen any evidence that the vulnerabilities have been exploited in the wild, it’s highly recommended to apply the patches to remove potential threats.
“Workarounds are convenient but do not eliminate vulnerabilities and can introduce additional complications that patching will not.” The company warned.
